This disclosure relates to controls, and more particularly to an electronic control architecture using integrated protection and backup control hardware.
Existing electronic controls utilize a primary control, a protection control, and an external backup control to control a device, also known as a “plant.” Under normal fault-free conditions the primary control controls the plant, and the protection control may assume control if the primary control malfunctions in a “non-gross” manner (i.e., the primary control is still operating but is experiencing an undetected error and requires assistance from the protection control to compensate for the error). The protection control is sometimes referred to as a “nanny”, because the protection control prevents unacceptable behavior by the primary control. The external backup control may assume control if the primary control experiences some threshold degree of damage or error from which the primary control cannot recover (e.g., a “gross error” which occurs if the primary control is unable to operate due to a channel-wide failure such as a primary control processor failure or a power supply failure).